Open-TGate
GitHub Operator login
Checking runtime…

Authorized Telegram
operations backend

Open-TGate is a private, safety-first backend built on TDLib. It keeps authorized Telegram accounts synchronized to a durable system of record — with persistent sessions, idempotent ingestion, and human-approval controls before anything is ever sent.

See the architecture Live status Source & docs
TDLib native sync engine
Supabase system of record
Zeabur always-on runtime
Cloudflare edge & WAF
What it is

A durable bridge between Telegram and your data platform

A persistent worker completes an authorized Telegram session through TDLib and continuously normalizes accounts, chats and messages into Supabase. State survives redeploys, ingestion is idempotent, and outbound sending stays disabled until approval controls pass verification.

🔒

Private by design

No public API surface for data. The dashboard proxies only health; direct API paths are refused at the edge.

♻️

Restart-safe

TDLib session and database state live on a persistent volume, so a redeploy resumes instead of re-importing.

🧾

System of record

Normalized entities and an outbox event stream land in Supabase — the durable source downstream systems read.

Capabilities

Built for reliable, authorized synchronization

Every capability is scoped to authorized operation and observable in production.

📡

Persistent TDLib worker

Loads native libtdjson, holds the session, and heartbeats liveness continuously.

🗂️

Entity sync

Accounts and chats normalized to durable records; per-chat backfill with resumable checkpoints.

⚡

Idempotent ingestion

Live updates UPSERT safely — no duplicates on retry, restart, or replay.

📤

Transactional outbox

Downstream events emit only after the database transaction commits.

🛰️

Sentry observability

DSN-gated error and performance reporting across api and worker; a no-op when unset.

🩺

Health & readiness

/healthz and /readyz gate deploys and rollbacks with real signals.

Delivery stack

Source to production, verified end to end

One canonical path — no drift, no untracked runtimes. Cloudflare fronts the public edge; Zeabur runs the always-on services.

Source
GitHub
Branches, PRs, required checks
→
Registry
Docker Hub
Immutable, versioned images
→
Runtime
Zeabur
api + worker, volume, health checks
→
Data
Supabase
Postgres, RLS, migrations
🌐

Cloudflare edge

DNS, TLS, proxy and WAF in front of the Zeabur API domain. This dashboard is a Cloudflare Worker that exposes only health.

📦

Immutable releases

Semver tags publish to Docker Hub; production pins an exact tag or @sha256 digest so rollback is one redeploy.

Safety posture

Least privilege, enforced by default

Safety is a property of the build, not an afterthought. These controls ship enabled.

✓
Outbound sending disabledEXTERNAL_SEND_ENABLED=false until approval controls pass verification.
✓
Sessions never leave the volumeTelegram session material stays on the worker's encrypted volume — never in secrets or the database.
✓
Admin-scoped APISystem endpoints require an admin token; the dashboard exposes no data paths.
✓
Untrusted inbound contentAll inbound Telegram content is treated as untrusted throughout the pipeline.
✓
No secrets in sourceOnly variable names and safe placeholders are committed; real secrets live in platform stores.
✓
Strict edge CSPThe dashboard serves a locked-down Content-Security-Policy and refuses direct API access.
Live

Runtime status

Checked from your browser against the API's public health endpoint.

Checking API… Contacting /healthz
Open /healthz

Outbound Telegram sending remains disabled until operator approval controls pass verification. This page performs no authenticated operations and stores no data.